CVE-2026-10284: falha de média gravidade em DevaslanPHP project-management
DevaslanPHP project-management Livewire ViewTicket.php doDeleteComment improper authorization
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.3epss 0.2%
A flaw has been found in DevaslanPHP project-management up to 2.0.0-beta1. Affected by this vulnerability is the function editComment/doDeleteComment of the file app/Filament/Resources/TicketResource/Pages/ViewTicket.php of the component Livewire Handler. Executing a manipulation can lead to improper authorization. The attack can be executed remotely. The project was informed of the problem early through an issue report but has not responded yet.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X
Produtos afetados
DevaslanPHP · project-managementCVEs relacionadas — DevaslanPHP project-management
No mesmo produto, das mais perigosas para as menos.
CVE-2026-10285MEDIUMDevaslanPHP project-management Ticket KanbanScrumHelper.php recordUpdated improper authorizationEPSS 0.2%CVE-2026-100899MEDIUMDevaslanPHP project-management Timesheet Dashboard MonthlyReport.php whereRaw sql injectionEPSS 0.2%CVE-2026-100898MEDIUMDevaslanPHP project-management Timesheet Dashboard ActivitiesReport.php whereRaw sql injectionEPSS 0.2%CVE-2026-100900MEDIUMDevaslanPHP project-management Jira Import jira-import updateJiraProjects server-side request forgeryEPSS 0.2%